What the US is watching that could signal Russia is launching an invasion of Ukraine

By Jeremy Herb, Katie Bo Lillis, Barbara Starr and Sean Lyngaas, CNN

It might be a cyberattack targeting Ukraine’s energy grid. Or the movement of Russian battalions and tanks along the border and into firing range. Or perhaps even a long-range missile attack.

They’re all potential signs US and European officials are closely monitoring that could reveal President Vladimir Putin is moving forward with an invasion of Ukraine. With more than 100,000 Russian troops amassed along the Ukrainian border — a number that continues to grow — military and intelligence officials are scrutinizing the latest tactical maneuvers to try to anticipate when Moscow might shift from threatening an invasion to launching one.

US officials say they’re closely monitoring cyber intrusions, like the attack that hit Ukraine’s government last month. They’re watching not just Russian troops that amass on the border but where they’re positioned, and they’re keeping an eye on what Russia is doing with its equipment like tanks that would be central to any ground invasion.

At the same time, current and former officials tell CNN that ultimately there may not be a clear tip-off for an attack on Ukraine. Like the rumbling of an earthquake, there may be little or no advance warning of an invasion before it’s already underway, officials say.

“If you look at the lower-end options, all of which are executable immediately with little to no warning with the forces that are already deployed — things like a punitive strike or raid in the East, a breakout from the south, a raid from the north—those forces are already in position and in the right number with the right capability,” a Western intelligence official told CNN.

Former Director of National Intelligence James Clapper told CNN that the US may not see the beginning of a whole-hog invasion until they see it. “If he shoots into Kyiv or any other major cities, then you know it’s a real deal,” Clapper said.

The assessment helps explain why President Joe Biden and top US officials have warned that a Russian invasion is imminent — an explanation that angered Ukrainian officials — because the Kremlin may need very little lead time before an attack is launched.

Invasion could happen ‘any day now’

While the White House said it would no longer call a Russian invasion “imminent,” a senior administration official said the assessment that an attack could happen “any day now” remains valid as the Russians have added logistics and sustainment to their forces on the border, as well as additional offensive and defensive weapons.

Russian officials have repeatedly denied they’re preparing to invade Ukraine, accusing the West of being responsible for escalating tensions there.

The White House on Wednesday approved a plan presented by the Pentagon for the nearly 2,000 US troops in Poland to help Americans who may try to evacuate Ukraine if Russia invades, according to two US officials familiar with the matter. The US forces are not currently authorized to enter Ukraine if a war breaks out, and there are no plans for them to conduct an evacuation like the US operation in Afghanistan last year, the officials emphasized.

Biden has also suggested that Americans should leave Ukraine now, and State Department officials have said they may not be in a position to help Americans still in the country should Russia invade.

Officials say there’s a distinction between different potential scenarios, whether Russia attacks Ukraine in a targeted way or whether the Kremlin is preparing for a full-scale invasion of the country to try to overthrow the government in Kyiv. In the latter case, the Russians would need more troops along the border, officials say, and satellite images would capture the continued build-up that the West has watched for months now.

“I don’t think the math is as simple as saying, there’s a magical number of (battalion tactical groups),” the Western official said. “It’s just generally speaking, more than we see now.”

But officials cautioned that Putin could also begin by using long-range artillery to attack Ukraine, where ground forces would not need to be in range.

Still, one of the key things the US is watching is for when a significant number of Russian forces leave their training areas near the border and move within firing range of their targets, which are specific ground positions, one administration official said.

Another signal that US officials are monitoring is the movement of Russian tanks, one US official said. One sign the Russian military could be gearing up for an invasion is if they start moving around tanks on the border, or turning them on or off, the official said, because if they sit there and don’t move for a few days the oil could freeze.

If they are turning them on and off, it prevents that from happening — meaning the tanks would be ready to go quickly. So far, the official said, the tanks are just sitting there, according to commercial satellite imagery.

The weather in Ukraine could also play a role, the assessment being that colder temperatures — and frozen terrain — would make a Russian incursion easier.

On alert for cyberattacks

US and Ukrainian officials say there’s a wide expectation that any Russian invasion could be carried out in conjunction with offensive cyber aggression toward Ukraine.

Victor Zhora, a Ukrainian official who investigated the January cyberattack of Ukrainian government websites, said last month there was “no doubt that (any Russian invasion) can be supported by cyber aggression — or at least they will stay active in cyberspace.”

US officials are closely watching for any signs of cyberattacks on Ukrainian critical infrastructure and are in touch with their Ukrainian counterparts on the issue, one US official told CNN. One concern is that Russia could use its hacking prowess to try to erode public confidence in the Ukrainian government.

“Could cyber be used to suggest the Ukrainian government is inept?” the US official said.

Since Russia annexed Crimea in 2014, suspected Russian hackers have disrupted Ukrainian critical infrastructure on multiple occasions, including by cutting power in parts of the country in 2015 and 2016.

“Cyber is an ideal tool for Russia to use prior to an invasion,” said John Hultquist, vice president of intelligence analysis at cybersecurity firm Mandiant, who closely tracks the Russian hacking group accused of the 2015 and 2016 disruptions. “You can use (cyber operations) to be aggressive, to signal (intent) and potentially erode the influence of your adversary before bullets fly or without necessary escalating the situation to war.”

Officials say Russia is already making use of so-called hybrid warfare techniques — unconventional tactics like cyberattacks, information warfare and the famous “little green men” that Russia famously relied on in the run-up to its 2014 assault on Crimea — making it difficult to pinpoint any one incident as a definitive signal that Moscow is preparing to escalate. The State Department claimed last week that Russia was prepared to fabricate “a pretext for an invasion” through a false-flag video.

The Western official noted that Ukraine was hit by a cyber operation last month that did not precede a conventional Russian attack.

“This one of the hardest questions to answer it because the baseline level of activity is so high focused on Ukraine — and here I mean hybrid and cyber,” the official said. “A one-off may not be the indicator that we’re looking for that a campaign is beginning.”

The-CNN-Wire
™ & © 2022 Cable News Network, Inc., a WarnerMedia Company. All rights reserved.

CNN’s Kylie Atwood contributed to this report.